feat(client): shell hands desktop connects to punktfunk-session (phase 3)

start_session_with routes desktop windowed connects to the spawned
Vulkan session binary (--connect --fp, --launch, --fullscreen from the
stream setting); spawn.rs bridges its stdout contract into the shell —
spinner until {"ready":true}, banner from the error/ended JSON line,
exit 3 + trust_rejected routed to the re-pair PIN ceremony, TOFU pins
the advert fingerprint only once the child proves it on a real connect.
The in-process GTK presenter stays for PUNKTFUNK_LEGACY_PRESENTER=1,
Gaming-Mode/--fullscreen and --browse launches (no second toplevel under
gamescope until phase 4 moves the console UI), the request-access flow,
and any spawn failure (silent fallback).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

clients/linux/README.md

@@ -79,7 +79,10 @@ src/
   ui_settings.rs          resolution · refresh · decoder · bitrate · compositor · mic
   ui_stream.rs            the stream window (GtkGraphicsOffload present) + input capture
   launch.rs               session launch/UI glue over the shared session pump
-  video_gl.rs             VAAPI dmabuf → RGBA GL presenter (EGL import, CICP-driven CSC)
+  spawn.rs                desktop connects → the punktfunk-session Vulkan binary
+                          (PUNKTFUNK_LEGACY_PRESENTER=1 keeps them in-process)
+  video_gl.rs             VAAPI dmabuf → RGBA GL presenter (EGL import, CICP-driven CSC;
+                          the legacy/fallback presenter)
 tools/screenshots.sh      store screenshot capture (app self-capture; Xvfb fallback)
 ```